Among their many responsibilities, IT administrators have the task of managing and securing access to an organization's information. To fulfill this obligation, IT administrators manage accounts and passwords for their users, and manage their users' ability to access the organization's various IT systems and data repositories.
One source of risk to the security of IT assets arises when an employee uses personal hardware or software to access the organization's hardware or software systems. An example class of such hardware is smartphones. Specifically, and rather than carry a personal phone to perform personal functions and a corporate phone to perform corporate functions and access corporate data, some users use their personally-owned smartphones as “dual use” personal/business phones, that serve both personal and work needs.
To reduce the risk of exposure to malicious hardware and software, or exposure of their data through malicious exploitation of otherwise benign hardware and software, companies may allow their employees to access corporate data with their smartphones or other personally owned computing devices under predetermined conditions. For example, companies may make sure that their employee's devices have secure access codes, encrypted file systems, and trusted application sandboxes in place before access to the organization's data is granted. Alternatively, IT administrators may prescribe approved configurations of hardware and software that have been tested for use in accessing the organization's data.
As employee-owned, dual-use devices become more common, the restrictions placed on these devices by traditional blacklists and whitelists may become too coarse. For example, in cases in which an IT department uses an application “blocked” list to define applications that are restricted from being installed on a device, the end user may consume time and data bandwidth to download an application only to discover that the application has been blocked from being installed on the device. Employees may find that such a framework may hamstring the usefulness of an application marketplace, particularly when the employee is not directly aware of what applications have or have not been approved for installation on a device that has access to an organization's IT resources. Furthermore, employees may spend money to license applications only to later discover that the applications have been blocked and therefore have little or no value to them.